Your organization has a hybrid Exchange environment with mailboxes both on-premises and in Exchange Online.
You need to ensure that all outbound email from Exchange Online to your on-premises servers is encrypted using TLS.
Which of the following is the BEST way to achieve this?